Governance & Internal Controls Flashcards

Which element of the COSO framework specifically involves identifying and analyzing risks that may prevent an organization from achieving its objectives?

Answer: Risk Assessment

Risk Assessment is the COSO component that requires management to identify and analyze risks that could impede achievement of organizational objectives.

A federal IG determines that an agency's financial management system lacks adequate audit trails for transactions. This MOST directly affects which internal control objective?

Answer: Reliability of financial reporting

Audit trails are essential for tracing transactions and verifying accuracy, directly supporting the reliability of financial reporting.

In governance frameworks, 'three lines of defense' refers to which arrangement?

Answer: Operational management, risk/compliance functions, and internal audit

The three lines of defense model positions operational management as first line, risk and compliance functions as second, and internal audit as the third independent line.

An agency implements continuous monitoring of its financial transactions using automated data analytics. This BEST represents which type of control activity?

Answer: Detective control

Continuous monitoring detects anomalies and errors after transactions occur, classifying it as a detective control activity.

According to GAO Government Auditing Standards, when auditors identify internal control deficiencies during a performance audit, they are required to:

Answer: Report significant deficiencies found during the audit

GAGAS requires auditors to report significant deficiencies in internal control identified during a performance audit in their audit report.

Which governance structure feature BEST ensures that an IG's findings reach appropriate oversight authorities even if agency management disagrees?

Answer: Dual reporting to the agency head and to Congress

Dual reporting requirements ensure IG findings reach Congress even when agency leadership disagrees or attempts to suppress findings, preserving independent oversight.

A control that requires managers to review and approve budget variances exceeding 10% is BEST classified as:

Answer: A performance review control

Reviewing budget variances against thresholds is a performance review control that compares actual results to budgeted expectations to identify anomalies.